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REASONS IN SUPPORT OF APPELLANTS 1 PRE-APPEAL 
BRIEF REQUEST FOR REVIEW 

Sir: 

This document is submitted in support of the Pre- Appeal Brief Request for Review 
filed concurrently with a Notice of Appeal in compliance with 37 C.F.R. 41.31 and with the 
rules set out in the OG of July 12, 2005 for the New Appeal Brief Conference Pilot Program, 
which has since been extended. 

No fee or extension of time is believed due for this request. However, if any fee or 
extension of time for this request is required, Appellants request that this be considered a 
petition therefor. The Commissioner is hereby authorized to charge any additional fee, which 
may be required, or credit any refund, to our Deposit Account No. 50-0220. 

REMARKS 

Appellants hereby request a Pre- Appeal Brief Review (hereinafter "Request") of the 
claims finally rejected in the Final Office Action mailed December 13, 2005 ("Final Action"). 
The Request is provided herewith in accordance with the rules set out in the OG dated July 
12, 2005. 

Claims 1-56 are pending in this application. Claims 1-56 stand rejected under 35 
U.S.C. § 102(e) as anticipated by United States Patent No. 6,735,701 to Jacobson 
("Jacobson"). Final Action, p. 3. Appellants respectfully submit that the rejected claims are 
allowable as the reference cited does not disclose all of the recitations of the independent 
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claims, either expressly or inherently. Therefore, Appellants respectfully request review of 
the present application by an appeal conference prior to the filing of an appeal brief. In the 
interest of brevity and without waiving the right to argue additional grounds should this 
Petition be denied, Appellants will focus on only the independent claims herein. 

Under 35 U.S.C. § 102, "a claim is anticipated only if each and every element as set 
forth in the claim is found, either expressly or inherently described, in a single prior art 
reference." M.P.E.P. § 2131 (quoting Verdegaal Bros. v. Union Oil Co., 814 F.2d 628, 631, 
2 U.S.P.Q.2d 1051, 1053 (Fed. Cir. 1987)). "The fact that a certain result or characteristic 
may occur or be present in the prior art is not sufficient to establish the inherency of that 
result or characteristic. To establish inherency, the extrinsic evidence 'must make clear that 
the missing descriptive matter is necessarily present in the thing described in the reference. 
Inherency, however, may not be established by probabilities or possibilities. The mere fact 
that a certain thing may result from a given set of circumstances is not sufficient. 1 " M.P.E.P. § 
2112 (citations omitted) (emphasis added). 

Independent Claim 1 recites: 

A method for managing a security policy for one or more users in a 
network, comprising: 

a) running a policy management program on a computer in 
communication with the network; 

b) enabling creation of a security policy document in a portable 
representation language using the policy management program , including 
selection and inclusion in the security policy document of a plurality of data 
elements for communicating the security policy to the one or more users and of at 
least one data element for implementinn the security policy on computer 
systems in the network ; 

c) enabling the one or more users on the network to view the security 
policy document using the plurality of data elements for communicating the 
security policy to the one or more users included in the security policy document ; 
and 

d) receiving electronic data relevant to user viewing of the security policy 
document using the policy management program, (emphasis added) 

Appellants submit that at least the highlighted recitations are clearly not disclosed by 
Jacobson and the pending rejections are based on a clear error of fact in alleging Jacobson 
discloses all these recitations. 
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In rejecting independent Claim 1, the Final Action cites to portions of columns 2, 10, 
1 1 and 19 of Jacobson. Final Action, p. 4. However, the only portion of Jacobson added 
responsive to the amendments to Claim 1 to add the highlighted portions of Claim 1 are at 
column 19, lines 19-32. Furthermore, in response to Appellants arguments regarding 
patentability of Claim 1, the Response to Arguments section of the Final Action states that 
the policy document, the data elements for communicating the security policy and at least 
one data element for implementing the security policy on a computer are taught by the 
excerpt at column 19, lines 19-32. The paragraph including this excerpt, in its entirety, reads 
as follows: 

Software resources include software listings and updates, guidelines for 
proper use including email etiquette, and netiquette training, Internet information 
and personal safety training, optional registration of an encryption private or 
public key with the system, a listing of the organization's approved and licensed 
software, software downloading guidelines and approved procedures, tech support 
for user's questions Registering newly downloaded software to the system, 
management approved trialware, shareware and others for review by the 
organization, operations and support information, regulation, policy, and Freedom 
of Information Act materials, information explaining how the system works 
including product support and services, telephony, text-based support, and in- 
house support options, a simple do & don't security module for non technical 
activity, and online safety information. (Jacobson, Col. 19, lines 17-32.) 

Even assuming the presentation of access to information on security policies is 
disclosed by this excerpt, there is no disclosure or even a suggestion of distinct data elements 
for implementing the security policy on a computer. As described, for example, at paragraph 
47 of the present specification, these data elements, for example, contain "the platform 
controls that link the written security policy to the mechanism for communicating the security 
policy to the computer systems 26 on the various platforms" and "the technical controls that 
link the written security policy to the mechanism for enforcing the security policy on the 
computer systems." Such data elements are not disclosed or even suggested by the excerpt 
relied on from Jacobson. 

In addition, while an HTML type provision of information to remote locations 
executing on browser is inferred in Jacobson, it does not follow that the HTML would 
disclose or suggest the "security policy document" of Claim 1. Instead, it merely indicates 
that screen display information, that may include information related to a "policy" may be 
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provided to remote locations in an HTML form. The "policy training module" and other 
modules of Jacobson are not described as creating a specific "security policy document" that 
contains such HTML form information. Instead, such displays may be standard page or 
frame displays saved on a system, text information stored in a database or the like and 
extracted by the policy training module and/or various known other ways to create HTML 
pages and the like. 

Furthermore, the Final Action appears to not even distinguish between the recited 
policy management program and the recited policy document of Claim 1 in applying 
Jacobson. The "network security policies stored in the database" of Jacobson, while arguably 
a document, are not even alleged in the Office Action as disclosing the particulars of "a 
security policy document" as recited in Claim 1 . Neither does Jacobson appear to discuss 
"enabling creation" of such stored policies by the described policy compliance monitor 1 10 or 
effectiveness module 120 (shown as coupled to the policy repository 125 of Figure 1 of 
Jacobson). 

Independent Claim 1 1 recites technical controls "for implementing the security policy 
on at least one first computer." In rejecting Claim 1 1, the Final Action asserts that these 
recitations are disclosed by Jacobson, Col. 2, lines 3-18, CoL 10, line 57 to Col. 11, lines 3 
and Col. 6, lines 47-57. However, at most these sections refer to "compliance actions" that 
may include "implementing a different security policy." However, as stated in these sections 
of Jacobson, a "security policy" is identified as "a set of rules designed to limit an 
organization's risk and liability." Implementing is described in Jacobson as training users on 
policy and, more particularly, using that training as a way to develop policies. See, Jacobson, 
Col. 5, lines 36-50. Thus, Appellants* submit that the portions of Jacobson relied on in 
rejecting Claim 1 1 (and Claim 1), while they recite "implementing a different security 
policy," do not disclose or even suggest creation of a security policy document including at 
least one data element for implementing the security policy on computer systems. Instead, 
they, at most, suggest changing rules for users and training users on those new rules to 
encourage compliance by increased user appreciation of the "organization's risk and liability." 

Independent Claim 26, like Claim 1, recites a distinct program and "security policy 
document." Claim 26 also recites configuring the security policy document to create both "a 
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human-readable security policy document" and a "machine-readable security policy 
document containing technical controls readable by" a computer. In rejecting Claim 26, the 
Final Action relies on the same excerpts of Jacobson as reproduced above that were used in 
rejecting Claim 1 1 . For reasons similar to those discussed with reference to Claim 1 1, 
Appellants submit that the cited excerpts of Jacobson do not include an anticipatory 
disclosure of such particular recitations of inclusion of human and machine information in a 
security policy document to provide security policy management "for one or more users and 
one or more first computers in a network" as recited in Claim 26 (emphasis added). 

Independent Claim 51, like Claim 1, recites a security policy document and separate 
program. In addition, Claim 51 includes human-readable and machine-readable format 
recitations similar to Claim 26. 

For at least the reasons discussed above, Appellants submit that the anticipation 
rejections of independent Claims 1, 1 1, 26 and 51, and the claims that depend, are clearly 
erroneous and should be withdrawn. Therefore, Appellants respectfully request that the 
present application be reviewed and the rejections of Claims 1-51 be reversed by the appeal 
conference prior to the filing of an appeal brief. ^ A 
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